1. Who processes information
TalkThem provides realtime website support and visitor communication tools. For account information and operation of the TalkThem service, TalkThem acts as the relevant controller or service operator to the extent required by applicable law. For visitor information collected by a customer through an installed widget, the customer generally determines the purposes of processing and TalkThem provides the technical processing service.
2. Information we may process
Account data: name, email address, protected password hash, 2FA settings, interface language and session information. Workspace data: websites, members, roles, widget configuration, templates, automations and notes. Conversation data: messages, timestamps, states and associated site context. Visitor data: IP address, approximate IP-derived location, browser/device user agent, pages and navigation events, session/profile identifiers, timeline events, notes and tags. Technical data: security logs, errors, Cloudflare request metadata and information used to prevent abuse. Billing data: plan, invoice/payment identifiers, amounts and statuses; provider secrets are not exposed through customer interfaces.
3. Why information is used
Information is used to deliver realtime chat, visitor presence, message routing, analytics, operator synchronization, push notifications, account and access management, billing, abuse prevention, troubleshooting and customer support. Customer Content is processed under Customer instructions and the DPA; product improvement uses technical, aggregated or de-identified information, or other information only where permitted by the applicable role and lawful basis. We do not sell user data to advertisers.
4. Legal bases
Depending on the context, processing may rely on performance of a contract, legitimate interests in operating and protecting the service, compliance with legal obligations, or consent where required. Customers are responsible for establishing the appropriate legal basis for processing their own website visitors' information.
5. Cookies, local storage and identifiers
TalkThem may use cookies, local storage and similar technical identifiers to authenticate users, retain interface preferences, protect sessions and maintain stable widget operation. These technologies are not used by TalkThem to build third-party advertising profiles.
6. Payment information
Cryptocurrency checkout is provided by NOWPayments. TalkThem receives the payment identifiers, amount, currency and status needed to activate and account for subscriptions. TalkThem does not receive or store users' cryptocurrency wallet private keys.
7. Mobile application and push notifications
The Android operator application may use Firebase Cloud Messaging to deliver push notifications. This requires processing a device push token and technical information needed to deliver the notification. The token is used only in connection with an authorized operator session.
8. Telegram and external integrations
If a customer uses the Telegram Mini App, Telegram fallback or another integration, relevant account/linking metadata and selected notification data are transmitted to that external service according to the customer's configuration. The customer is responsible for tokens, chat IDs and lawful use of the selected communication channel.
9. Infrastructure providers
TalkThem may rely on Cloudflare, hosting/cloud infrastructure, email delivery providers, NOWPayments, Firebase and other suppliers necessary to operate the service. They receive only the information reasonably needed to perform the relevant function and are subject to their own security and privacy obligations.
10. International transfers
Infrastructure providers and users may be located in different countries, so information can be processed outside a user's home country. Where applicable law requires safeguards for cross-border transfers, available contractual or other lawful transfer mechanisms are used.
11. Retention
Information is kept for as long as needed to provide the service, honor configured retention settings, maintain security, resolve disputes and meet legal obligations. Conversation and activity data may be automatically purged according to retention settings. Backups may retain information for a limited additional period until normal rotation completes. Records evidencing acceptance of Terms/DPA and related contractual audit records may be retained longer where reasonably necessary to establish the agreement, resolve disputes, prevent abuse or comply with legal obligations.
12. Security
TalkThem uses scoped roles, protected sessions, optional TOTP two-factor authentication, encryption for sensitive secrets at rest, payment-signature verification, network protections, rate limiting, audit logging and other technical measures. No system can guarantee absolute security, and account owners must also protect their devices and credentials.
13. Privacy rights
Depending on applicable law, you may have rights of access, correction, deletion, restriction, portability, objection and withdrawal of consent. Website visitors should generally contact the owner of the website/workspace first regarding visitor data. Requests concerning a TalkThem account can be submitted through the official support channel.
14. Children
TalkThem is designed for businesses and professional customer support and is not directed to children. We do not intentionally create accounts for people below the minimum age at which they may independently consent under applicable law.
15. Policy changes
We may update this Policy as functionality, suppliers or legal requirements change. The current version and updated date will be published on this page.
16. Contact
Privacy questions and account-data requests can be submitted through the official TalkThem support channel available at talkthem.com or through the authenticated panel at panel.talkthem.com.
17. Privacy Mode, CMPs and pre-interaction visitor data
A website owner can select Standard or Essential until consent; newly created sites default to Essential until consent. In the stricter mode, before permission is provided by the site’s CMP, TalkThem does not persist a visitor/session identifier in local storage and does not create a passive visitor profile/timeline merely from viewing the page. A necessary technical session may be used to deliver the widget itself; when a visitor intentionally opens the chat or sends a message, data needed to provide the requested support may be processed independently of passive profiling. Customer is responsible for selecting the mode and passing consent signals consistent with its lawful basis.
18. Regional rights and complaints
Additional rights may apply under GDPR/UK GDPR and US state privacy laws. Where TalkThem acts as processor/service provider for visitor data, requests should generally be directed first to the relevant website owner. A data subject may also have the right to complain to the competent data-protection authority. TalkThem does not sell Customer Personal Data or use it for cross-context behavioral advertising.